Skip to main content
The activity log is a running record of significant events in your tenant. Find it under Activity in the Iru dashboard. Use it to answer questions like who changed this setting, did that sign-in succeed, and when did this user’s access change, without leaving the dashboard.
The activity log is a read-only history. Events are recorded as they happen; you cannot edit or delete them. This makes the log a dependable source for reviews and investigations.

​
What gets recorded

Each entry captures a single event and the context around it. The log brings together several kinds of events in one place:

Administrator actions

Changes administrators make in the Iru dashboard: creating and editing users, groups, applications, policies, roles, and settings.

Sign-in outcomes

The results of sign-in decisions, so you can see whether access was granted or denied and follow a user’s recent activity.

Lifecycle changes

Events as users and access move through their lifecycle (for example a user becoming active or suspended, or access being granted and removed.

​
Reading the log

The activity list shows one row per event, sorted with the most recent first. Each row summarizes the event across these columns: Select any row to expand it. The expanded view shows the event’s details, including a field-by-field list of what changed, each affected field with its previous value and its new value, so you can see exactly what an action modified.
Sort the list by any column header. Sorting by Actor or User groups events by who performed them, or by the user they are about.

​
Filtering the log

Select Filter above the list, then choose one or more of these filters:
  • Occurred At: limit the list to when the event happened.
  • Activity: limit the list to one kind of event, such as App sign-in, Iru sign-in, User created, or Authenticator created.
  • Outcome: separate successful events from events that were denied or not completed.
  • User: focus on the user the event is about.
  • Actor: focus on who or what performed the event.
  • Application: show events for one application. The application appears in the Target column.
Combine filters to get the view you want. For example, set Activity to App sign-in and Outcome to Denied by policy to see denied application sign-ins.
Filters stay applied when you leave the activity log and come back.

​
Using the log for audit

Because every significant event is captured with its user, actor, activity, outcome, and the exact fields that changed, the activity log doubles as an audit trail. A few practices make it more useful:
Filter to high-signal events, such as denied sign-ins or user and authenticator changes, and review them on a schedule. The filters remain when you return to the activity log.
Filter by User or Application to pull the history of one user or application, then expand individual events to see what changed and who changed it.
Filter by Activity, User, and Outcome to follow a user’s recent sign-in results when you are troubleshooting access or responding to a report.
For how Iru protects your data and the controls behind your tenant, see Security and privacy.

Administrators & roles

Control who can administer Iru Identity and what each administrator can do.

Authentication policies

See the policies that produce the sign-in outcomes recorded here.